1. Parties and scope
This agreement is between the merchant that uses True2Size ("you", the controller) and True2Size, Paxlaan 10, 2131 PZ Hoofddorp, the Netherlands ("we", the processor). It is part of our Terms of Service and applies automatically when you use the True2Size app; no signature is needed. If you want a signed copy, email privacy@true-2-size.com.
It covers personal data we process on your behalf through the size advisor on your store. It does not cover shoppers' saved size profiles ("Save my size"): those are True2Size accounts the shopper controls, for which we are the controller (see the Privacy Policy).
2. What we process
- Purpose: showing shoppers a size recommendation and size chart on your product pages, selecting or adding the size to the cart, and giving you analytics about it.
- Data subjects: visitors of your store who use the size advisor.
- Data: answers to the size questions (usual size, fit preference, and if you ask for them height, weight, age range, gender, brand sizes), products viewed with the size advisor, recommended sizes, and usage events (shown, opened, closed, size selected or added to cart). No names, addresses, payment data or IP addresses are stored for this.
- Special categories: none intended. Do not configure questions that ask for health or other sensitive data.
- Duration: as long as you use True2Size, then as described in section 9.
3. Our obligations
- We process the data only on your documented instructions: these terms and your settings in the app. If we believe an instruction breaks the law, we tell you.
- Everyone at True2Size who can access the data is bound to confidentiality.
- We take the security measures in section 6.
- We help you, as far as we reasonably can, to answer requests from shoppers (access, deletion and so on) and to meet your obligations on security, breaches and impact assessments.
- We do not sell the data, and do not use it for any purpose other than providing the service, except anonymous and aggregated data as described in the Terms (A5). For California and other US state laws, we act as your service provider or processor, and will not retain, use or disclose the data outside the business purpose described here, or combine it with other data except as these laws allow.
4. Service providers (sub-processors)
You authorize us to use the service providers listed in our Privacy Policy. For data under this agreement, these are mainly Hetzner (servers, Germany) and Resend (email). We bind every provider to data protection terms at least as protective as these, and remain responsible for them.
Before we add or replace a provider that processes this data, we update that list and, if you asked us by email at privacy@true-2-size.com, notify you at least 14 days in advance. You may object on reasonable data protection grounds; if we cannot resolve it, you may stop using the service.
5. International transfers
The data is stored in the EU. Where a provider processes it outside the EEA, we make sure the transfer is protected by an adequacy decision (such as the EU-US Data Privacy Framework) or the European Commission's Standard Contractual Clauses, with the UK and Swiss additions where those laws apply.
6. Security measures
- Encryption of all traffic (HTTPS with HSTS); store access tokens encrypted in the database.
- Servers and database in a secured data center in Germany; the database is not reachable from the internet.
- Each store's data is separated by account; store data can only be read through the store's own server connection, never with the public key used in storefronts.
- Access limited to the people who run True2Size, with personal keys; secrets kept out of the code.
- Rate limits and strict input checks on public endpoints; one-time codes for shopper sign-in.
- Data kept only as long as needed (retention periods in the Privacy Policy), deleted automatically.
- Dependencies kept up to date, security issues tracked and fixed with priority.
7. Data breaches
If we become aware of a personal data breach affecting your data, we tell you without undue delay, and in any case within 48 hours, with what we know about it and what we are doing, so you can meet your own reporting duties.
8. Audits
On request, we give you the information you need to show that this agreement is met. If that is not enough, you may have an audit done once a year, by an independent auditor bound to confidentiality, with 30 days' notice, during business hours and at your cost, unless a supervisory authority requires it.
9. End of processing
When you uninstall True2Size, we delete the data processed for you, at the latest 30 days after uninstalling (Shopify normally asks us 48 hours after uninstalling), except anonymous data and data the law requires us to keep. Before that, you can ask us for a copy at privacy@true-2-size.com.
10. Other terms
Liability under this agreement follows the Terms of Service. If this agreement and the Terms conflict on data protection, this agreement applies. Dutch law applies.
Wording for your privacy policy
You can add this, or similar wording, to your store's privacy policy:
We use True2Size to help you find your size. When you use the size advisor on our product pages, your answers (such as the size you usually wear and how you like clothes to fit) are used to recommend a size for that product. True2Size processes this on our behalf and does not store your answers with your name or email. If you choose "Save my size" and confirm your email, True2Size keeps your saved size so you can use it on other stores with True2Size, and we can see your email and saved size. You can download or delete it at any time in the size advisor. More information: true-2-size.com/privacy.